Equifax CSO 'Retires'. Known Bug Was Left Unpatched For Nearly Five Months (marketwatch.com)

phalse phace quotes MarketWatch: Following on the heels of a story that revealed that Equifax hired a music major with no education related to technology or security as its Chief Security Officer, Equifax announced on Friday afternoon that Chief Security Officer Susan Mauldin has quit the company along with Chief Information Officer David Webb.

Chief Information Officer David Webb and Chief Security Officer Susan Mauldin retired immediately, Equifax said in a news release that did not mention either of those executives by name. Mark Rohrwasser, who had been leading Equifax's international information-technology operations since 2016, will replace Webb and Russ Ayres, a member of Equifax's IT operation, will replace Mauldin.
The company revealed Thursday that the attackers exploited Apache Struts bug CVE-2017-5638 -- "identified and disclosed by U.S. CERT in early March 2017" -- and that they believed the unauthorized access happened from May 13 through July 30, 2017.

Thus, MarketWatch reports, Equifax "admitted that the security hole that attackers used was known in March, about two months before the company believes the breach began." And even then, Equifax didn't notice (and remove the affected web applications) until July 30.

Comments

Not noticing?? That's bad

[davidwr]

I can see a company delaying patching serious bugs long enough to test it and make sure the fix isn't worse than the bug.

I can see a company treating bugs that aren't reported as being serious as non-serious.

I can see a company assessing a "serious" but and determining it's not serious in their environment and not treating it with urgency.

But that's not what happened here.

Heads deserved to roll and at least two did.

Re:Not noticing?? That's bad

[Anonymous Coward]

They didn't officially notice the breach until after they sold off their stock shares... So they say.

Re: Not noticing?? That's bad

[Anonymous Coward]

But but but but WOMEN IN TECH.
This is what happens when you hire someone because she has a vagina instead of actual qualifications.

This. Exactly this. Hire based on qualifications, not on gender.

Re:Not noticing?? That's bad

[pop ebp]

When the break-in first came to light, lots of people criticized Equifax, but a vocal minority said something along the lines of "No system is absolutely secure. We don't know if the hackers used a zero-day vulnerability against Equifax. They could have followed all the security best practices and still be hacked."

My response was "If the past is any guide, every time a major company was hacked, it was eventually traced to vulnerabilities in outdated software that should have been patched months ago. I am going to assume this is the same."

Turns out I was right. Companies never learn.

Incompetent idiots

[Anonymous Coward]

Blaming this on a single security flaw just shows how incompetent they are. It's your design and approach at security that's flawed to begin with.

Allowing some shiny MVC framework directly accessing a database containing millions and millions of personal records is just plain dead retarded software design. This kind of incompetency should be fined, let's start with $100 for every record that got stolen in compensation. If such an incident can instantly bankrupt you, maybe then these companies start to take their software security serious.

Re: Incompetent idiots

[that this is not und]

A lot of 'sensitive information', namely things like SSN, are only sensitive because the credit application process has been so sensitized. Credit extending companies want it to be trivially easy to extend credit. They want the cashier at a clothing store to be able to issue a credit card to customers at the point of sale. So things that used to be ordinary accessable information like SSNs are made into secrets, for the convenience of credit issuing companies.

When I attended college at a small liberal arts school in 1979 they didn't really have a student ID number. They just used students' SSNs as an id. So SSNs were scattered all over campus fairly freely. You used a card with your SSN on it at the library to check out books.

There is really no reason for this not to be okay, except for businesses who want to be able to use your SSN as a sort of 'secret password' to allow youbto go into debt to them.

Patching is not the only answer.

[ErikTheRed]

I have some (extremely limited) sympathy for patching "deep applicaiton infrastructure" things like Struts, because it can take quite a bit of QA to make sure that the patches don't break the application or make the problem worse. That being said, it's a top priority and companies - especially in a PCI or similar compliance environments - need to budget the time and resources to deal with issues like this, because they will pop up on a regular basis.

That being said, this problem could have been blocked without patching. First of all, an application-level proxy / API that sanity checks the types and rate of requests should have been between the public web application and the database back end. All sorts of mischief can be either stopped or at least slowed down here, and the failure to have something list this is a major architectural error. Secondly, a reverse-proxy (or load balancer) could look for attacks of this nature and block them before the get to the web server. F5's products are explicitly capable of stopping this CVE, and I'm sure some of their competitors can do it as well.

Security needs to exist in layers, because at some point people will screw up at one layer or another. That's just human nature, and it will not change until AIs take over the world and enslave us, but that's a problem for 2019.

Re:Patching is not the only answer.

[Gravis Zero]

it will not change until AIs take over the world and enslave us, but that's a problem for 2019.

Actually, that was a problem for 2019 which we solve in 2047 by solving the problem 1997. We pushed Clippy into Microsoft office and everyone saw much earlier how annoying he was and it sealed his fate before they made him intelligent. You wouldn't believe how annoying it was to be enslaved by a smart version of Clippy. I don't know what the future hold but thank your lucky stars we aren't going to be enslaved by Omega Clippy. I still have nightmares about it... ("Looks like you're trying to breathe, would you like me to push air into your lungs?" "Fuck you, Clippy! Just let me die!" "Your response is illogical, you will live to continue serving us.")

what a bs.

[kiviQr]

A company that holds that much information should have top notch security. That includes penetration testing, penetration detection and multiple layers. Public layer should never have access to database that has that much information. There should be an internal webservice that returns filtered information information. This is 101 security!

Just curious...

[bagofbeans]

..but were David Webb and/or Susan Mauldin amongst those execs that sold shares before the breach was made public?

Re: Hire based on diversity

[arth1]

It means the all things being equal between candidates in technical knowledge

In all my years of sorting through job applications and conducting interviews, "all things being equal" has never occurred.

Instead, what does occur is that HR managers or upper management hint strongly that "won't someone rid me of this meddlesome diversity quota imbalance". The end result is that some will hire the first diversity candidate that in good light meets absolute minimum requirements, despite there being better candidates available.

Re: Hiring anti-tech employees is a bad idea

[sinij]

Thing is, this is what 'next quarter' corporate culture rewards - accountants and lawyers cooking books and lobbying for government handouts.

Not quite

[bagofbeans]

If everyone old enough to receive credit or get a job locked down their CRA files, the CRAs would go out of business.

Look for:
1. The lock down fee changing from one-off to a yearly subscription.
2. The definition of what access is allowed to a person's locked down file to be changed to allow everything but opening a new account.

Not really

[rsilvergun]

She retired. She wasn't fired. So she'll get to take it all with her. Once again, the ruling class (and at CSO level she's a member) take care of themselves. And once again, I sure wish we could get the working class to do the same. Hell, we can't even get the working class to agree Healthcare is a right and not a privilege.

The trouble is nobody likes paying programers

[rsilvergun]

to sit around waiting for these kinds of things. But you need skilled people to do it and there's only so many H1-Bs you can have work full time on one thing while three or four times a year ramping up to an 80+ hour work week. Most experienced programmers won't put up with those kinds of hours except occasionally. Once they figure out it's part of the job they leave if they can.

So you either find a way to get the indentured servants that are folks here on work visas or you pay people to sit around waiting for problems and fixing them. It's usually only $300-$500k/yr. A sizable chunk of change but still quite affordable to large companies. But saving that $300-$500k was somebody's bonus the year the decision was made.

No circling of the wagons for Equifax

[timholman]

I wondered if Equifax intended to circle the wagons, hold on to upper management, and then try to buy, bribe, or schmooze their way out of this mess via political channels. For a lesser P.R. disaster than this recent exploit, such a strategy might have worked.

But abruptly canning the CSO and CIO says three things to me:

(1) Equifax's internal auditing shows that this mess is considerably worse than what has been publicly revealed so far.

(2) The CEO has now shifted to "I have to save my own job" mode. The CSO and CIO have been thrown under the bus, and more will probably follow.

(3) Equifax is going to take it on the chin, financially speaking. Canning the CSO and CIO is a clear admission that Equifax was negligent. The lawsuits are going to increase exponentially from this point. But worse than that is the overwhelming demand by millions of consumers to freeze their credit reports. Equifax (along with Experian and Transunion) makes a lot of money selling credit information to banks so that they can offer credit cards to you. Credit freezes prevent that. Every new credit freeze is another hit on the annual bottom line. Equifax is bleeding from millions of tiny cuts, and it will only get worse.

Frankly, it couldn't happen to a more deserving bunch of guys.